Multiprocessor system for restricting an access request to a shared resource

ABSTRACT

A multiprocessor system including a first processor element, and a second processor element that includes a CPU, a shared resource unit shared by the first and second processor elements, a protection setting unit and a guard unit, and the protection setting unit sets an access protection range for the shared resource unit, the guard unit restricts an access request from the first processor element to the shared resource unit based on the access protection range, the guard unit issues an exceptional access notification signal when the access request from the first processor element is within the access protection range, and when the exceptional access notification signal is issued, the CPU extends the access protection range in such a manner that the extended access protection range is wider than the access protection range set before issue of the exceptional access notification signal.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is a Continuation Application of U.S. patentapplication Ser. No. 12/076,941, filed on Mar. 25, 2008, which is basedon Japanese Patent Application No. 2007-079160 filed on Mar. 26, 2007,the entire contents of which are hereby incorporated by reference.

BACKGROUND OF THE INVENTION

The present invention generally relates to a multiprocessor system andan access protection method conducted in the multiprocessor system orspecifically to a multiprocessor system in which each of processors hasa shared resource which is commonly used by other processors, and anaccess protection methods conducted in the multiprocessor system.

In recent years, large numbers of multiprocessor systems have beenutilized in which resources such as memories are shared among aplurality of processors. In such multiprocessor systems, the followingproblem occurs. That is, information stored in a memory area which isutilized by one processor can be erroneously overwritten because ofpossible runaways of tasks executed by other processors. If such anoverwrite problem occurs, the normal operation of the task underexecution by the processor is impeded, so the system operation of themultiprocessor system is brought into a failure.

Under such a circumstance, JP 09-297711 A (hereinafter, referred to as“related art 1”) discloses the technique related to the multiprocessorsystem capable of mutually avoiding the adverse influences caused by therunaways of the tasks among the plurality of processors. FIG. 9 is ablock diagram for illustrating a multiprocessor system 100 disclosed inthe related art 1. As represent in FIG. 9, in the multiprocessor system100, a first processor 101A is connected to a second processor 101B viaa system bus 105. Each of the first processor 101A and the secondprocessor 101B includes a CPU board 101 and a memory board 103. The CPUboard 101 includes an address producing unit 102, while the addressproducing unit 102 is connected to the memory board 103 via a local bus104. In the multiprocessor system 100, when an access operation isperformed from the first processor 101A to the memory board 103 of thesecond processor 101B, an address conversion is performed in the addressproducing unit 102 thereof. As a consequence, a control operation iscarried out in such a manner that an area which is used by the secondprocessor 101B in the memory board 103 to be mounted on the secondprocessor 101B is not invaded by an access request issued from the firstprocessor 101A.

In the related art 1, an address producing unit 102 controls accessoperations with respect to memory boards mounted on other processors byreferring to access protection range setting values which have beenpreviously set to a register in a fixing manner. Also, JP 2002-32352 A(hereinafter, referred to as “related art 2”) discloses such a structurecapable of changing the access protection range setting values byutilizing the programmable logic device (PLD) as the register of therelated art 1 even after the multiprocessor system has beenmanufactured.

However, even in the related art 2, the access protection range settingvalue cannot be changed in response to the utilizing conditions of theprocessor. In other words, the access protection ranges cannot bedynamically set in response to the programs which are executed by theprocessors. Under the above-described difficulties, the multiprocessorsystems disclosed in the related art 1 and 2 have a problem that theresources cannot be shared by the processors in a flexible manner.

SUMMARY OF THE INVENTION

According to the present invention, there is provided a multiprocessorsystem having a first processor element and a second processor element,the first processor element and the second processor elementindependently executing a program, in which the first processor elementincludes: a central processing unit for performing an informationprocessing based upon the program; a shared resource which is sharedbetween the first processor element and the second processor element;and a guard unit for restricting an access request issued from thesecond processor element to the shared resource based upon an accessprotection range setting value designated by the central processingunit.

In the multiprocessor system according to the present invention, theguard unit restricts the access request issued from the second processorelement based upon the access protection range setting value designatedby the central processing unit. In other words, the access protectionrange setting value can be changed in response to the program which isexecuted by the central processing unit. Since the above-describedaccess restriction is conducted, in accordance with the multiprocessorsystem related to the present invention, the restriction of the accessrequests issued from the second processor element to the shared resourceprovided in the first processor element can be set based uponprocessings under execution by the first processor element. Also, it ispossible to avoid the area in the shared resource, which is used by thefirst processor element, from being invaded by the program underexecution by the second processor element.

Further, according to the present invention, there is provided an accessprotection method conducted in a multiprocessor system having a firstprocessor element and a second processor element, the first processorelement and the second processor element independently executing aprogram, the access protection method including: sending, by the secondprocessor element, an access request with respect to a shared resourcecontained in the first processor element; and in the case where theaccess request is received by a guard unit and the access request ispresent within a range of access protection range setting valuesdesignated by a central processing unit employed in the first processorelement, sending back, by the first processor element, an accessviolation value with respect to the second processor element;invalidating, by the first processor element, the access request; andnotifying, by the first processor element, an occurrence of anexceptional access with respect to the central processing unit.

The access protection method conducted in the multiprocessor systemaccording to the present invention further includes, when the accessrequest is present within the access protection range, sending back theaccess violation value with respect to the second processor elementwhich has sent the access request. As a result, the second processorelement can detect that a violation occurs in a task based upon theprogram under execution by the second processor element. Also, theaccess protection method conducted in the multiprocessor systemaccording to the present invention further includes, when the accessrequest is present within the access protection range, invalidating theaccess request, and notifying the occurrence of the exceptional accesswith respect to the first processor element. As a consequence, the firstprocessor element can grasp that the exceptional access occurs from thesecond processor element.

In accordance with the multiprocessor system and the access protectionmethod conducted in the multiprocessor system according to the presentinvention, reliability of the programs executed by the processorelements respectively can be improved.

BRIEF DESCRIPTION OF THE DRAWINGS

A multiprocessor system and an access protection method in accordancewith preferred embodiments will now be described, by way of exampleonly, with reference to the accompanying drawings in which:

FIG. 1 is a block diagram for schematically illustrating an arrangementof a multiprocessor system according to a first embodiment of thepresent invention;

FIG. 2 is a block diagram for schematically illustrating an internalstructure of a guard unit employed in the multiprocessor system of thefirst embodiment of the present invention;

FIG. 3 is a schematic diagram of a protection information holding unitprovided in the multiprocessor system of the first embodiment of thepresent invention;

FIG. 4 is a flow chart for illustrating operations of the multiprocessorsystem of the first embodiment of the present invention;

FIG. 5 is a flow chart for illustrating operations of the guard unitemployed in the multiprocessor system of the first embodiment of thepresent invention;

FIG. 6 is a block diagram for schematically illustrating an arrangementof a multiprocessor system according to a second embodiment of thepresent invention;

FIG. 7 is a block diagram for schematically illustrating an arrangementof a multiprocessor system according to a third embodiment of thepresent invention;

FIG. 8 is a block diagram for schematically illustrating an arrangementof a multiprocessor system according to a fourth embodiment of thepresent invention; and

FIG. 9 is a block diagram for schematically illustrating the arrangementof the multiprocessor system according to the related art.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

Referring now to drawings, a description is made of embodimentsaccording to the present invention. FIG. 1 is a block diagram forschematically illustrating an arrangement of a multiprocessor system 1according to one embodiment of the present invention. As shown in FIG.1, in the multiprocessor system 1, a first multiprocessor element “PE-A”is connected to a second processor element “PE-B” via a bus.

The first processor element PE-A includes a central processing unitCPUa, a read-only memory (ROM) 15 a, a guard unit 16 a, a resourcecontroller 17 a, and a shared resource 18 a. It should be understoodthat in the first embodiment, the second processor element PE-B has thesame structure as that of the first processor element PE-A. In thesecond processor element PE-B, a central processing unit CPUbcorresponds to the central processing unit CPUa; a ROM 15 b correspondsto the ROM 15 a; a guard unit 16 b corresponds to the guard unit 16 a; aresource controller 17 b corresponds to the resource controller 17 a;and a shared resource 18 b corresponds to the shared resource 18 a. As aconsequence, in the first embodiment, while the first processor elementPE-A is employed as an example, a structure of a processor element willnow be described. It should also be understood that each of theabove-described processor elements maybe realized so that a centralprocessing unit, a guard unit, and a shared resource have beenmanufactured on the same semiconductor substrate, or may bealternatively realized so that a plurality of processor elements havebeen manufactured on the same semiconductor substrate.

The central processing unit CPUa includes a control unit 11 a and anexecuting unit 12 a. The control unit 11 a designates a memory area soas to manage a data saving area. In the memory area, data which is usedby, for instance, a task corresponding to the unit of an execution forexecuting a program to be executed by the executing unit 12 a, isstored. This management is performed by a memory management unit (MMU)13 a. The executing unit 12 a executes various sorts of processings foreach task by reading the program thereinto. Also, the executing unit 12a includes a load/store unit (LO/ST unit shown in FIG. 1) 14 a. Theload/store unit 14 a performs a judgment based upon memory managementinformation instructed by the MMU 13 a so as to read-access, orwrite-access data which is used by a task with respect to the resourcecontroller 17 a.

The ROM 15 a is a storage area for a program which is read by thecentral processing unit CPUa. It should also be noted that although theROM 15 a is employed as the program storage area in this embodiment, theabove-described program storage area is not limited to the ROM 15 a, butmay be realized by any area to which the central processing unit CPUacan access.

While the guard unit 16 a is connected via the bus to the secondprocessor element PE-B, the guard unit 16 a receives an access requestsent from the second processor element PE-B. Also, to the guard unit 16a, an access protection range setting value “SEa” is inputted from thecentral processing unit CPUa via a protection information setting bus.The access protection range setting value SEa can be set via theprotection information setting bus only from the first processor elementPE-A. The guard unit 16 a judges whether an access request sent from thesecond processor element PE-B should be permitted, or should be rejectedbased upon this access protection range setting value SEa andinformation acquired from the access request. In other words, the guardunit 16 a controls an access request sent from the second processorelement PE-B to the first processor element PE-A. In addition to theabove-described access control, when the guard unit 16 a judges that anaccess request should be rejected based upon the access control, theguard unit 16 a notifies an occurrence of an exceptional access to boththe first processor element PE-A and the second processor element PE-Bby employing exceptional access notification “Ea.” A detaileddescription will be made of the guard unit 16 a later.

The resource controller 17 a is a control apparatus for controlling theshared resource 18 a, and controls a random access memory (RAM) in thefirst embodiment. The resource controller 17 a produces a control signalfor the shared resource 18 a based upon an access request sent from thecentral processing unit CPUa and another access request which has passedthrough the guard unit 16 a and then has been received. At this time,the resource controller 17 a executes an arbitration processing betweenthe access request sent from the central processing unit CPUa and theaccess request passed through the guard unit 16 a to be received, andfurther produces a control signal with respect to the shared resource 18a from information contained in the access request. As theabove-described information contained in the access request, there are,for example, access address information, and information for designatingaccess attributes such as a read access request and a write accessrequest. In the case where the access request sent from the centralprocessing unit CPUa corresponds to an access request to the secondprocessor element PE-B, the resource controller 17 a sends an accessrequest with respect to the second processor element PE-B.

The shared resource 18 a corresponds to a resource which is commonlyused between the first processor element PE-A and the second processorelement PE-B. In the first embodiment, a memory is used as the sharedresource 18 a. As a consequence, the shared resource 18 a according tothe first embodiment includes a RAM 181 a. Also, in the RAM 181 a, aPE-A exclusively-used area 182 a is defined. The PE-A exclusively-usedarea 182 a corresponds to such a protection area which is defined basedupon the above-described access protection range setting value SEa, andis varied based upon a value of the access protection range settingvalue SEa.

A detailed description is made of the guard unit 16 a. FIG. 2 is a blockdiagram for schematically illustrating an internal structure of theguard unit 16 a. As shown in FIG. 2, the guard unit 16 a includes aprotection setting unit 21, a judging unit 22, an access invalidatingunit 23, a response producing unit 24, and an exceptional accessoccurrence notifying unit 25. The protection setting unit 21 includes aplurality of setting information holding registers. Then, theinformation related to the access protection range setting value SEaoutputted by the central processing unit CPUa is stored in the pluralityof setting information holding registers, respectively. While aschematic diagram of this protection setting unit 21 is shown in FIG. 3,the plurality of setting information holding registers will now bedescribed more in detail. In the example of FIG. 3, such a case wherethe protection setting unit 21 includes 16 pieces of the above-describedsetting information holding registers is exemplified. As shown in FIG.3, each of the plurality of setting information holding registersincludes a protection range setting register, an enable flag register,and a protection attribute register. A range of an address value on amemory is stored in the protection range setting register, and thisaddress value range corresponds to an access protection range. Theprotection range indicated by the protection range setting register isassumed as an exclusively-used area for the first processor elementPE-A. A flag value “EN” is stored in the enable flag register. Forexample, when the flag value EN stored in the enable flag register is“1”, this flag value EN indicates that setting of the protection rangestored in the relevant protection range setting register is valid,whereas when the flag value EN stored in the enable flag register is“0”, this flag value EN indicates that setting of the protection rangestored in the relevant protection range setting register is invalid. Theaccess attribute is stored in the protection attribute register. Thatis, the access attribute is provided in order to set whether or not anaccess request is rejected in the case where the access request which isissued with respect to the address range to be stored in the protectionrange setting register corresponds to which access attribute. As theaccess attributes, for instance, there are a Write (writing) accessattribute, a Read (reading) access attribute, a Read/Write(reading/writing) access attribute, and the like. It should also beunderstood that a content to be set to this protection attributeregister does, not need to be necessarily changeable, but maybe fixedas, for example, a write attribute.

The judging unit 22 includes a violation detector 221. The violationdetector 221 compares a valid value of the protection setting rangeregister with an access request (namely, access address and strobe) tobe inputted so as to judge whether or not the access request is locatedwithin the access protection range. As a result of this judgment, whenthe access request is located within the access protection range, theviolation detector 221 brings an error notification signal into arejected status. In such a case where flag values of the enable flagregisters provided in all of the protection setting range registersindicate invalidation, while the violation detector 221 does not outputthe error notification signal, the access control function of the guardunit 16 a becomes invalid.

The access invalidating unit 23 includes a selector SEL1 which selects,in response to the error notification signal, one of allowing thepassage of the access request sent from the second processor elementPE-B, and the output of an access invalidation value. In the case wherethe error notification signal is under permission status, the selectorSEL1 allows the access request sent from the second processor elementPE-B to pass therethrough. On the other hand, in such a case where theerror notification signal is under rejected status, the selector SEL1outputs the access invalidation value. This access invalidation valuecorresponds to, for example, an “Idle” command on a bus which isconnected to the resource controller 17 a, namely such a command forindicating that no access request is sent to the resource controller 17a.

The response producing unit 24 includes another selector SEL2 whichselects, in response to the error notification signal, one of allowingthe passage of a memory response, and the output of an access violationvalue, which are outputted from the shared resource 18 a of the firstprocessor element PE-A. In the case where the error notification signalis under permission status, the selector SEL2 allows responseinformation. (for example, memory responses such as ready, a memoryaccess error, and data) outputted from the resource controller 17 a topass therethrough. On the other hand, when the error notification signalis under rejected status, the selector SEL2 outputs the access violationvalue. This access violation value is different from the memory accesserror value corresponding to one of the memory responses, and is such avalue for notifying that the access request is access violation to thesecond processor element PE-B. When the first processor element PE-A orthe second processor element PE-B receives the access violation value, aprocessing based upon the access violation value is preferentiallyexecuted in an interrupt processing manner irrespective of theprocessing under execution in the relevant processor element PE-A, orPE-B.

The exceptional access occurrence notifying unit 25 produces anexceptional access occurrence notification signal in response to theerror notification signal. The exceptional access occurrencenotification signal is, for instance, such an interrupt request signalwhich notifies that an exceptional access occurs with respect to thecentral processing unit CPUa. This interrupt request signal may beaccepted at proper timing in response to a processing under execution bythe central processing unit CPUa.

The guard unit 16 a also includes a wiring which causes write data forthe shared resource 18 a to pass therethrough, the write data being sentin combination with the access request. This wiring is connected betweena data input terminal “DIN” and an internal input terminal “DIIN.”

Next, a description is made of operations of the multiprocessor system,while operations of the multiprocessor system 1 are exemplified in sucha case where an access request is issued from the first processorelement PE-A. FIG. 4 is a flow chart for illustrating the operations ofthe multiprocessor system 1 in this case. As shown in FIG. 4, when anaccess request is issued from the LO/ST unit 14 a provided in thecentral processing unit CPUa, the MMU 13 a judges whether or not theissued access request is permitted (Step S1). When the MMU 13 a judgesthat the access request corresponds to a violation in Step S1,exceptional access occurrence notification for notifying that the accessviolation occurs is made with respect to the central processing unitCPUa. As a consequence, the central processing unit CPUa restarts, forexample, a task under execution, or restarts a program itself underexecution. On the other hand, when the MMU 13 a permits the accessrequest in Step S1, the resource controller 17 a judges a subject memorywhich should be accessed (Step S2).

When the resource controller 17 a judges that the subject memory is theRAM 181 a provided on the first processor element PE-A in Step S2, theresource controller 17 a writes data into the RAM 181 a. On the otherhand, when the resource controller 17 a judges that the subject memoryis the RAM 181 b provided on the second processor element PE-B in StepS2, the resource controller 17 a sends an access request to the guardunit 16 b provided on the second processor element PE-B.

The guard unit 16 b judges whether or not the access request sent fromthe first processor element PE-A is present within the access protectionrange designated by the central processing unit CPUb of the secondprocessor element PE-B (Step S3). In the case where the access requestsent from the first processor element PE-A is present outside the accessprotection range (permission) in Step S3, the first processor elementPE-A accesses the RAM 181 b of the second processor element PE-B. On theother hand, in such a case where the access request sent from the firstprocessor element PE-A is present within the access protection range(violation) in Step S3, the guard unit 16 b outputs an accessinvalidation value to the resource controller 17 b of the secondprocessor element PE-B in order to notify an occurrence of anexceptional access with respect to the central processing unit CPUb. Inaddition to the executions of these processings, the guard unit 16 boutputs an access violation value to the first processor element PE-A.When the first processor element PE-A receives the access violationvalue, the received access violation value is notified to the centralprocessing unit CPUa, and thus, the central processing unit CPUapreferentially executes an interrupt processing based upon the accessviolation value irrespective of other processings under execution. As aresult, the first processor element PE-A detects the occurrence of theviolation and thus restarts (otherwise, stops) the task under execution.Alternatively, the first processor element PE-A restarts (otherwise,stops) the program itself under execution. Also, because the secondprocessor element PE-B can detect that the abnormal event has occurredin the first processor element PE-A, the second processor element PE-Bmay perform the processing, such as the extension of the accessprotection range with respect to the occurrence of the abnormal event,or continuation of only a task which utilizes the access protectionrange.

FIG. 5 is a flow chart for illustrating the processings executed by theguard unit 16 b in Step S3. Referring now to the flow chart of FIG. 5,operations of the guard unit 16 b will be described in detail. Firstly,when an access request is issued with respect to the guard unit 16 b,the violation detector 221 reads a value of a valid register byreferring to all of the protection range setting registers (Step S4). Atthis time, in such a case where all of these protection range settingregisters are invalid (branch “YES” of Step S4), the guard unit 16 bpasses the access request sent from the first processor element PE-A tothe resource controller 17 b of the second processor element PE-B (StepS6). Next, the resource control 17 b sends backs the execution result ofthe access request via the guard unit 16 b to the first processorelement PE-A as a memory response (Step S7). As a result, the bus cycleof the first processor element PE-A is completed (Step S8).

On the other hand, when a valid protection range setting register ispresent in Step S4 (branch “NO” of Step S4), the violation detector 221judges whether or not the access request is present within the accesspermission range by referring to a value of this valid protection rangesetting register (Step S5). When the access request is present withinthe access permission range (branch “YES” of Step S5) in Step S5, theguard unit 16 b executes the above-described processings defined inSteps S6 to S8. On the other hand, when the access request is presentoutside the access permission range (branch “NO” in Step S5), the accessinvalidating unit 23 sends an access invalidation value to the resourcecontroller 17 b instead of the access request in order to invalidate theaccess request (Step S9). Also, the response producing unit 24 sendsback an access violation value to the first processor element PE-A (StepS10). Further, the exceptional access occurrence notifying unit 25outputs an exceptional access notification signal to the centralprocessing unit CPUb (Step S11).

As previously described, one processor element according to the firstembodiment includes a guard unit to which an access protection range isset by a central processing unit arranged in the own processor element.Then, the above-described guard unit judges whether or not an accessrequest sent from another processor element is present within the accessprotection range, and cuts off such an access request which should berestricted. As a consequence, while each of the processor elementssecures the, exclusively-used memory area used by the own processorelement, another memory area which is not used as the exclusively-usedarea can be shared by another processor element as the shared memoryarea. Also, the processor element according to the first embodimentincludes the protection information setting register for storing theaccess protection range setting value which is designated by the ownprocessor element. Under such a circumstance, the processor elementaccording to the first embodiment can change setting of the protectionrange in the flexible manner. For instance, the processor element canchange the protection range in response to statuses of processings underexecution by the own processor element.

Further, because the access request issued with respect to theexclusively-used area is invalidated by the guard unit, there is nopossibility that the data to be stored in the exclusively-used area isinvaded by a task which is executed by another processor element. Undersuch a circumstance, the processor element of the first embodiment canimprove the reliability of the task under execution by the own processorelement.

Also, in the conventional multiprocessor system, an access violationcaused by another processor element with respect to the own processorelement could not be notified to another processor. As a consequence, inthe conventional multiprocessor system, another processor element couldnot recover the operation by restarting the task with respect to theabnormal event occurred between the processor elements.

In contrast to the above-described conventional multiprocessor system,when the exceptional access is issued from another processor element,the guard unit according to the first embodiment produces theexceptional access occurrence notification signal with respect to theown processor element, and further, sends back the access violationvalue with respect to another processor element. As a result, both theown processor element and another processor element can detect theoccurrence of the exceptional access. As previously described, if theoccurrence of the exceptional access can be detected, the respectiveprocessor elements can prevent the enlargement of the abnormal event,can recover the abnormal task, or can perform the continuous operationbased upon only a task judged to be safe. In other words, in the ownprocessor element, the defense level with respect to the abnormal eventoccurred in another processor element is changed, so the task underexecution by the own processor unit can be protected. Also, in anotherprocessor, element, at the time when the abnormal event occurs in thetask, this task is restarted, so the multiprocessor system can berecovered from the abnormal condition at an earlier stage. As aconsequence, the multiprocessor system including the processor elements,according to this first embodiment, can improve the reliability thereof.

FIG. 6 is a block diagram for schematically illustrating an arrangementof a multiprocessor system 2 according to a second embodiment of thepresent invention. As shown in FIG. 6, in the multiprocessor system 2, afirst processor element PE-A2 includes an I/O interface 183 a as ashared resource 18 a. Also, in the multiprocessor system 2, a strictureof a second processor element PE-B is identical to that of the firstembodiment.

A resource controller 17 a employed in the second embodiment controlsthe I/O interface 183 a based upon an access address. A device 30 to becontrolled is connected to the I/O interface 183 a, while this device 30is known as, for example, an air bag. In this example, it is so assumedthat the second processor element PE-B has no an access right withrespect to the I/O interface 183 a.

As previously described, a guard unit 16 a is provided with respect tothe first processor element PE-A2 mounted on the multiprocessor system2, so even when a runaway of task for the second processor element PE-Bhappens to generate an access request issued with respect to the I/Ointerface 183 a, the issued access request is invalidated by the guardunit 16 a. As a consequence, the multiprocessor system 2 can avoid thatthe air bag is erroneously operated with respect to a runaway of a taskfor another processor element.

In other words, as the shared resource 18 a, not only a memory, but alsovarious sorts of resources may be set. Also, in a multiprocessor systemhaving such a shared resource, a guard unit is provided, so reliabilityof the multiprocessor system can be improved.

FIG. 7 is a block diagram for schematically illustrating an arrangementof a multiprocessor system 3 according to a third embodiment of thepresent invention. As shown in FIG. 7, in the multiprocessor system 3, afirst processor element PE-A, a second processor element PE-B, and athird processor element PE-C are provided, the second processor elementPE-B having the same structure as that of the first processor elementPE-A. Then, the first processor element PE-A, the second processorelement PE-B, and the third processor element PE-C are connected to eachother via a bus. Even in such a case, the reliability of themultiprocessor system 3 can be improved by a guard unit 16 in a similarmanner to that of the first embodiment.

As described in the multiprocessor system 3, in the case where two ormore processor elements are connected to each other, a multi-master buswhere a plurality of processor elements each constitute a master, forexample, may be employed as a bus structure.

FIG. 8 is a block diagram for schematically illustrating an arrangementof a multiprocessor system 4 according to a fourth embodiment of thepresent invention. As shown in FIG. 8, the multiprocessor system 4 usesa coprocessor 50 as a second processor element, which does not include aguard unit and a shared resource. In this case, even when an abnormalevent occurs in a task executed in the coprocessor 40 and thus an accessrequest is issued with respect to an access protection range, the guardunit 16 a of the first processor element PE-A invalidates this accessrequest. In this embodiment, because the first processor element PE-Aincludes the guard unit 16 a, the task which is executed in the firstprocessor unit PE-A can be protected.

In other words, in accordance with the multiprocessor system accordingto the present invention, in the multiprocessor system arranged byemploying a plurality of processor elements, if a guard unit is mountedon at least one piece of the above-described multiprocessor element,then the reliability of the multiprocessor system can be improved.

It should also be understood that the multiprocessor system of thepresent invention is not limited only to the above-describedembodiments, but may be properly modified without departing from thescope of the present invention. For instance, protection information tobe stored in the protection setting unit 21 is not limited only to theaccess protection range setting values of the above-describedembodiments, but may be properly modified in correspondence withsystems.

What is claimed is:
 1. A multiprocessor system comprising: a firstprocessor element; and a second processor element that includes acentral processing unit (CPU), a shared resource unit shared by thefirst and second processor elements, a protection setting unit and aguard unit, wherein the protection setting unit sets an accessprotection range for the shared resource unit, wherein the guard unitrestricts an access request from the first processor element to theshared resource unit based on the access protection range, wherein theguard unit issues an exceptional access notification signal when theaccess request from the first processor element is within the accessprotection range, and wherein when the exceptional access notificationsignal is issued, the CPU extends the access protection range in such amanner that the extended access protection range is wider than theaccess protection range set before issue of the exceptional accessnotification signal.
 2. A multiprocessor system including a firstprocessor element and a second processor element, the multiprocessorsystem comprising: the first processor element, comprising: a firstshared resource unit; a first protection setting unit that sets a firstaccess protection range for the first shared resource unit; and a firstguard unit that restricts an access request from the second processorelement to the first shared resource unit based on the first accessprotection range; and the second processor element, comprising: a secondshared resource unit; a second protection setting unit that sets asecond access protection range for the second shared resource unit; anda second guard unit that restricts an access request from the firstprocessor element to the second shared resource unit based on the secondaccess protection range, wherein when the first guard unit detects anaccess violation from the second processor element, the first processorelement extends the first access protection range in such a manner thatthe first extended access protection range is wider than the firstaccess protection range set before the detection of the accessviolation, and wherein when the second guard unit detects an accessviolation from the first processor element, the second processor elementextends the second access protection range in such a manner that thesecond extended access protection range is wider than the second accessprotection range set before the detection of the access violation. 3.The multiprocessor system according to claim 2, the first processorelement further comprising a first resource controller, wherein thefirst resource controller judges a target resource of the access requestfrom the first processor element, wherein the first resource controllerhandles the access request with the first shared resource unit when thetarget resource is the first shared resource unit, and wherein the firstresource controller sends the access request to the second guard unitwhen the target resource is the second shared resource unit.
 4. Themultiprocessor system according to claim 2, the second processor elementfurther comprising a second resource controller, wherein the secondresource controller judges a target resource of the access request fromthe second processor element, wherein the second resource controllerhandles the access request with the second shared resource unit when thetarget resource is the second shared resource unit, and wherein thesecond resource controller sends the access request to the first guardunit when the target resource is the first shared resource unit.
 5. Themultiprocessor system according to claim 2, wherein the first sharedresource unit includes an input and/or output interface unit.